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Our phones today carry all our secrets and they do not leave us 
at all times unlike the personal computer or mobile, these 
phones carry our pictures and messages know who we call and 
when and know all the places we hesitate and the capabilities of 
our mobile phones increased as well as we have become 
miniature computers carrying dozens if not hundreds of 
Programs We download these programs often without knowing 
what these programs are doing. Or what powers do they 
require? 

















application permissions 


2 



6jLaj <jjj3tSJt ^jJIulaj &j-aIj jjaW uij-^-A j aj^JL dj-uJt Jlaj dj^oL ^tuuVt j*-a j&,U^t 
jUa jit Jz\ (ja ^jl& ^Luiitj S^uaJtj AUaij ^aSaaII AjSlxJt Jxaj AJjxj V^bVt ^ilt 
## Jaj La) (jj-lj) ^jj ^Jt (jLuiikb ^in (j-A j A j AJt j Ai-iuaj ^LutV) 

First Lesson: From series the security of smartphones 


application permissions 

Our phones today carry all our secrets and they do not leave us at all times unlike 
the personal computer or mobile, these phones carry our pictures and messages 
know who we call and when and know all the places we hesitate and the 
capabilities of our mobile phones increased as well as we have become miniature 
computers carrying dozens if not hundreds of Programs We download these 
programs often without knowing what these programs are doing. Or what powers 
do they require? 

Many applications violate the privacy of users where the synchronization of 
private messages, contacts, device metadata, images, flies and other sensitive data, 
so control the powers of applications is imperative to maintain your privacy and 
prevent the sharing of your personal information with unknown parties for 
propaganda or intelligence purposes 

So .... How do we get rid of these powers and prevent applications from accessing 

them 

• Note 

The first and second methods do not need technical skills to use them. Method 3, 
4, and 5 require advanced technical skills to install the application control tools 
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I Method 1: application permissions I 

In Android 6.0 versions there are 7.2 power management (application 

permissions) by default 

O Go to Settings and then Settings Manager 
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O Then select the application 
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O These are the permissions and you will find all permissions enabled 

O Cancel the activation of the validity that you want to prevent the 
application from accessing 
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IMethod2; APK PERMISSION REMOVER | 



A simple and simple way to rely on reverse engineering of the application but not 
effective in all applications where you can not delete or ban powers that are essential 
and the application will stop if you delete them 


O Upload APK PERMISSION REMOVER PRO official version paid 
here 
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I Paid version features 



O The application does not contain advertisements 
O Allows to modify the permissions of more than 10 applications 


O The application's function is to modify the APK and permanently 
delete the application's permissions 

O To select an APK on memory, press Open an apk 

> 

O To select a installed application, press Open an a 


APK 

Permission 

Rervtover 


Ti ai B i 


Open ad app 




SUPPORT 


W 
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O You will see a list of the applications installed on your phone 
O Select the application to edit or deauthorize 



Open an app 


© 


Riot 

im.vector.alpha 

SmartWorld 

com.lge.lgworld 


TextNow 

com.enflick.android.TextNow 


flj Threema 

ch threema.app 


© 


Threema QR Code Plugin 

Q ch.threema.qrscannerplugin 

Tutanota 

de.tutao.tutanota 


UC Browser 

com.UCN4obile.intl 

WallR 

zebrostudio.wallrlOO 


Please Inpu... Find 


Close 


O These are the application's powers 




O To delete the validity, press the 0 sign next to the validity to 
become^ 


y 


O Then press SAVE & RE INSTALL 
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TextNow 


PERMISSION 


IMAGI 


MANIFEST 


device wilhout showing them to you 


'am< ra 


Take pictures and videos 

android permission CAMERA 

Allow* the app to take pictures and wdeos witMhe camera This 
permission allows the app to use the camera at any time without 
you confirmation, 


r< ph 


Wc 


one 


Record audio 

android permissiortiftEOORD AUDIO 


Allows the app to record audio with the microphone. This 
permission allow* the app to record audio at any time without 
your confirmation 


four 


ocation 


Approximate location (network-based) 

android permis*ton.ACCESS.COARSt LOCATION 
Allow* the app to get your approximate location, This location is 
derived by location services usog network location sources such 
a* celt towers and Wi Fi These location services must be turned 
on and available to your device for the app to use them Apps may 
use this to determine approximately where you are 


social I 


four 


Read your contacts 

android permission RtAO.CONTACTS 
Allows the.app to read d^|atxwt yow contacts stored on your 
phene,ir.:rthwhichyouVecalled.emailed, 
or communicated ^rnth specific individuals This 

permission f you contact data, and malicious 


Save & Re-Install 


Close 


Working Hard.. 


TECH_SLIPPORT 
Q) SR444TAW 
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application permissions 


O Now delete the old version of the application you have modified and 
install the new modified version 

O Press unistall to delete the old version and after deletion press install 
to install the modified version 


♦ Important 

Before you modify the application, verify that it is transferring data to another 

application or device 



Re-mstaifabCfl needed 

RJease tost uninstall (he old app by dick UfWnsta't and (hen fe-lnstall 
rt by dick Insult 


Uninstall 


Install 


Close 


§0 
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TextNow 


Do you want to install an update to this 
existing application? Your existing data 
will not be lost. The updated application 
will get access to: 

NEW ALL 



This update requires no new permissions, 
i ■^ TECH_SUPPORT 
, SIM 141 AW 


CANCEL INSTALL 
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TextNow 

Installing... 




; CA 

Easy way to work on all versions of Android from 3.2 to 0.6, depending on the 
reverse engineering of the application, but you can not control all the powers where 
there are basic powers depend on the application during the operation such as access 
to the Internet or read the internal memory if you delete the application will destroy 
but verify before installing Apps from deleting powers that violate your privacy such 
as syncing your phone history, reading phone status, and accessing location, camera, 

and mik e 
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I Method 3: Feature. Privacy Guard I 

Privacy Guard is a virtual feature with Lineage OS that allows the user to control the 
powers of general applications such as access to contacts and geographical location 



O Do the options shown in the following image to automatically activate 
the PrivacyGuard feature for newly installed applications 



V 

Electronic Horizons Foundation I is an independent foundation aims to raise Security awareness among Muslims 
Q SR444TAW Q EHF_TS Horizons @Chatwith.xyz 




application permissions 


14 



O Click Allowed to grant the 


r 1 

application 


O Click Ignored to prevent the application from accessing the 
permissions 


■ 


access to the permissions 


w 




O Click Always ASK to show a notification when the app reaches the 


validity of your location 
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O Click Advanced for advanced settings 



O Through the following settings you can see which applications have 
access to your geographical location or messages 
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Important Notice: Support for Xposed Framework has been lifted due to 
[security vulnerabilities that pose a threat to users' security. We do not| 

using Xposed applications! 


Xposed [ Method 4: Xprivasy ] 



An open-source Xprivasy application developed by a member of the XDA Developers 
site was awarded the Best Appraisal App for 2013 from BlackDuck 

Xprivasy is one of the best applications that allows full control of the powers of 
applications installed on the machine, where it has many features to manage the 

powers of applications 

Xprivasy does not delete permissions from the application, but it provides 
applications that want access to a certain validity as your location fake fake data or 
prohibit it from accessing this authority, unlike other applications such as Apk 
permission Remover or ADV Permission Remover. These applications are based on 
reverse engineering Application and applications often stop when you remove or 

delete their basic privileges 

GO I I 

-You must have a RUT permission if you do not know what routine or 
method to install it click her^ 

- Take a backup of the system if you do not know the way to go to this 
link from here 


- Install the Xposed Framework 

- Download the Xprivasy application from Google Play Store or Xposed 
Installer 


O Xprivacy application interface 


V 

Electronic Horizons Foundation I is an independent foundation aims to raise Security awareness among Muslims 
Q SR444TAW Q EHF_TS Horizons @Chatwith.xyz 






application permissions 


17 




XPrivacy 

Pro version 


% 


All 


■ © 

('"<■< ’ tO t'K t 


97/191 



10167 Ama/e 

■ 

f 



10166 Android Explow 

■ 

7 



10165 AnySoft Keyboard 

■ 

? 



10164 Any Soft Keyboard - Arabic 
LangoagePiKk 

■ 

? 



10163 APK Editor Pro 

■ 

? 


B«. 

10162 APK Permission Remover 

■ 

? 


□«." 

10161 App Goner 

■ 

? 


0 ^® 

10160 App Manager 

■ 

? 


Qi 

10159 Applications Info 

■ 

7 

□ 

1015$ Stavt 

■ 

■ 


10157 CMIc$rom 

■ 

■ 

mem 












Application settings 


CO 
& 


\ 




Sort I Choose to browse applications based on name or date of installation 

FILTER I To filter applications such as showing main system 
applications with installed applications or showing installed 
applications only 

Usage Data I To review a list of permissions that applications have 
requested access to or have been rejected by Xprivasy 
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rj c 


XPrivacy 

Pro version 

Sort 




Filter 



All 




< -• < ■ :o ■:< • 1 

Usage data 



UK 

10167 Amaze 

Template 




10166 Android 

Operations... 




10165 AnySofl 

Switch theme 



IQa 

10164 AnyScft 
language Rack Settings 




10163 APKEdl „ , 

Help... 




10162 APK FV^mission Remover 

■ 

? 

□ 

10161 App Goner 

■ 



10160 App Manager 

■ 

* 

□ 

j&yme poRT 

■ 

? 

□ 

"WM 4TAW 

■ 

- 

04® 

10157 Cholfegrom 

■ 

■ 

CM 







<_ XPrivacy : 

301/5424 3.57/s 

ong press function rwme fo white or block list parameter 

13 22:20 vi 

1000 intemet/connect 

connocttvitycheck gstattc.com:80 

13.-22:20 

1000 network/Networklnlo^jetExIralnfo 

13 22:20 \j 

• • 1: i •: A i!••! *< • si b<- tA !lB y Marr. i O: N. t 

connectivity-check gslatic.com 

■ :• 22.1 7 

10174 internet/ 


CorincctfvityjjetActivefietwofklnfo 

12 22:1/ 

101 /4 internet/NctworklnfoiiCoonccted 

13-22:1/ 

101 internet/Nctworklnfo.eetOe«.i)!edSt.itc 

13:22:1/ 

.V *i\. ? ! ;:rrli<-.s<-Tl:nVAridrev.ei 

13:22:17 it 

10174 phone/getSimOperator 

□ 

10156 inlcmet/Networklnfo.iyConnected 

13:22:1 0 

10156 internet/ 

Connectivlty^etActTvcNetworidnfo 

13 22:1 0 

101 j* intcmct/NctworklnfoqtctOctailcdStatc 

13:22:1 0 

101 * internet/Link PropertievgeH inkAddrc-wcs 

13:22:1/ M 

'.1 '■ account',.'get Account^ByTy pelocP.Kk.isc 

comgoogle 

13-22:1/ v: 

10174 phone/Conf>guration.MNC 

13:22:1/ « 

10174 phone/Confteuration.MCC 

13:22 1/0 

10075 ipc/Birvder 

IPxkagcManager.gctP.KkagcUtd 

13:22:1 Q 

10074 Ipc/Binder 

iP.KkageManager.gctftKkageUfd 

13 22:1.- □ 

10097 Internet/ 

13:22:1* 0 

10097 mtcrrtet/Networklnfo.isCoonected 

13:22:1/ □ 

ICO?/ Intcmet/Networklnfo.getOetjiledStatc 

□ 

-. ,■ : : ■- 

13:22:1*Q 

10097 intcmet/Nelworklnfo getStatc 

□ 

1009/interne t/Conrvc<«vity.gctNctv/orklnfo 

13-22:1 □ 

10097 ipc/Binder 

lAcpyityMan.iger-.RLk.CON 1LN I.PROVIO 

R 

□ 
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Tamplate I To set default settings to block access from publicly installed 
applications, for example, you can block all newly installed applications 
from accessing your location 



10165 AnySoft 

0 10164 AnySofl 

language Pack Settings 




10163 APK Edl 


Help... 



10162 APK Permission Remover 

■ 

T 


10161 App Goner 

■ 

? 

■k® 

10160 App Manager 

■ 

? 

O; 

10159 Apjpfiestioru Jnfo 

■ 

? 

□ 

10158 Brpvt 

■ 

■ 


10157 Chalfegrom 

■ 

■ 








O Activate the option next to the? r o be activated V that is, your 
installed applications have become blocked from accessing this 
authority that you have specified 

O Then press Done 


|L_ 

lr 
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XPrivacy 

Pro version 

Sort 




Filter 



All 

Usage data 



Check to restrict: 



| ^ 10167 Ama/e 

i & 

Template 



|CJ l0166AndroiJ 

MM| 

Operations... 



10165 AnySoft 

Switch theme 



1 1^1 10164 AnySofl 

1 language Rack 

Settings 



I Q 10163 APKEdl 

Help... 



10162 APK Emission Remover 

■ 

? 

^ 10161 AppCloner 

■ 

? 

I ^ ^ 10160 App Manager 

■ 

7 

^^9 10159 Appficotions Info 

■ 

? 

10158 Breve 


■ 

■ 

^ ** 10157 Cholfegrtf/n 

■ 

■ 

mo* A CV 
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Select All To select all applications installed on the device 

Toggle restrictions Toggle Block (Clear previous block settings) 

Export I Save a file for Xprivacy settings on the system 

Import I Adds a file to the Xprivacy settings on the system 

Submit restrictions I To apply blocking and control privileges to all 
applications 

Fetch restrictions I Displays the permissions for installed applications 



XPrivacy 

Pro version 

All 

Check to restrict: 




Gk 


®, 


Select all 

Toggle restrictions 

Export 

Import 

Submit restrictions 


- 10165 Any Soft I 

Fetch restrictions 


O 10161 Any Sou Keyboard • Arabic _ ^ 

language Pack * 

? 

? 


□ 


10163 APK Editor Pro 

10162 APK Permission Remover 


10161 AppCIoner 


® 

A ' 
A® 
A® 

A 


10160 App Manager 


TECH SUPI 

101 59 Appfcations Info 


1 OiSBBrovr 

10157 Cholkgram 


■ ? 
■ ? 
■ ? 
■ ■ 



Switch theme I To change the color of the theme 
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Settings I 




1 10165 

^ Switch theme 

□ 10164 AnySofl 

^ - - 




ivivri rviy^vn 

languageRack Settings 
Help.. 


10163 APKEdl 


10162 APK Permission Remover ■ 

10161 AppCloner ■ 

I n ® 

^ 10160 App Manager ■ 

q 

Q '»<»■“ ■ 

^ ^ " IOI57Chol(ej»cm ■ 

am 1 Of:, 




10164 AnySofi 



! L-K 

Settings 



[_] 

[ri 

i □ ^ 

10163 APK E0I 

Help... 





10162 APK Permission Remover 

■ 

? 


□ 

rV^ 1 

10161 App doner 

■ 

? 


lo^ 

5 " 

10160 App Manager 

■ 

? 



,I^ULSilE p0RT 

■ 

? 



■ 

■ 


^ 10l57CJMltejr<NT> 

■ 



cn a 


a. 
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O Make sure you activate the first three options 



Settings 


Q Update notifications 
Q Restrict on demand 
Q Show application usage data 
Q Show parameters of usage data 
Q Show values of usage data 
[~l Debug log (requires reboot) 

Q Expert mode 

Q Restrict system components (Android) 

Q Use secure connections 

TECH_SUPPOF 

I I AOSP mode (requires reboot) 

( JSR444TAW 

Maximum fetch confidence interval 
Quirks freeze,resolve.test.updates 


|i5 




In the Settings box, you will find below other options: 

O Verify that the Randomize on boot option is enabled after the boot 

O Then click randomize NOW Random 

/( I TV 

O Activating all the options below the MAC address, ID, phone ID, etc., 
where Xprivasy will provide applications with counterfeit data 


O Then press the 'disk icon above to save the adjustments 
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Settings 


FLUSH CACHE 


CLEAR ALL XPRIVACY DATA 


Q Randomise on boot 


RANDOMIZE NOW 



f Randomirc on access 

□ trial* 63AC238502104566 

□ i ititude 23.8854096 


□ msitude 24.3985286 


■Altitude 75.87759981690576 
SEARCH _ Christmas Island 


□ :ac address 1C:A3:06:DA:A1:AB 




O Return to the application interface 


O The blue option indicates the box to close the application's 
permissions 

CD la, ft 

O The default option indicates the activation of the question property 
when the application requests access to a specific validity as in the 
following image 
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* © 


Check to restrict: 


LiK 


10167 Ama/e 


10166 Android Explorer 


□ 

□ 


^ 10165 AnySoftKcyboanj 

10164 AnySoftKeybo*rd - Arabic 
^ Language Pack 


10163 APK Editor Pro 


10162 APK Permission Remover 


k e 

k® 

I 

I 

«• 

i A Ch 


10161 App Cloner 


10160 App Manager 


10159 Applications Info 


10157 Chaflegrom 




In the following example, the Xprivacy application displays a notice to block or allow 
the Protonmail application to gain access to the Internet 


Category I Where the type of validity appears - in the following example 
Internet shows access to the InterneLk 

l /V 

Functions I The validity function appears - in the following example, the 
validity function is defined as the connection 

parameters I The IP address and port to be accessed by the application 
appear 

Expert mode (Advanced settings to control the validity of a particular 
application where you can give the application access to the Internet for 
only 15 seconds by activating the option for once for 15 S and then the 
notification appears again after 15 seconds, and the option to apply to 
Category 


Category I is to block / On the Internet either the option of Whit / 
Blacklist to insert the IP address and port to the Automatic Block List 
or Blacklist Allow Whitelist 


V 

Electronic Horizons Foundation I is an independent foundation aims to raise Security awareness among Muslims 
Q SR444TAW Q EHF_TS Horizons @Chatwith.xyz 








application permissions 


26 



6 1010? ProtonMail 

Usage attempt oft 

Category: Internet 

Function: connect 

Parameter* Iocalhostl0022 
Q Expert mode 

Q Apply to entire category 

I I Once for 1$S » 

□ White/WackBst localhosl: 10022 

Applying to the category will reset the function 
exceptions to defoult values 


Timeout will: Allow 

Please submit /cur resircbom to help oti tis 



O Select any application to m powers 



XPrivacy 

Pro version 

% i 

All 

• © 

Check to restrict: 

92/191 

| U ^ ~ 10167 A™" 

a f 

I ^3 \ ^ 10166 Android Explorer 

m ? 

10165 AnySoh Keyboard 

■ ? 

I 10164 AnySolt Keyboard • Arabic 

B 7 

1 language Pack 

■ • 

I 03 ^ 10163 APK Editor Pro 

■ ? 

10162 APK Permission Remover 

■ ? 

' 10161 App C loner 

■ ? 

| ^ 10160 App Manager 

■ ? 

10159 Applications Info 

■ ? 

10153 Drove 

■ ■ 

^ 10157 CMIc$tom 

■ ■ 

mam ▲ Cfr 
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? To activate the question property when the application requests 
access to a specific validity 
Y Close the application's validity 
v To show more control options 




XPrivacy ; 

Amaze 

10167 Amjit 

© 

3.1.2RC1 

Ij0l com amare fitemanager 

Check to restrict:_ _ 

& •' 

^ g^ © Accounts 

■ ■ 

V (T) Browser 

■ ■ 

vr 0 Calendar 

✓ ? 

^ g^ © Calling 

^ ? 

^ © Clipboard 

? 

v 0 Contacts 

■ ■ 

v 0 Dictionary 

? 

v 0 E mall 

v' ? 

, CYSR444TAW 

V ^ Qy Identification 

■ ■ 

^ ^ 0 Internet 

■ 





CO 


n 



£>rtarro 


Some applications may be disabled when they are denied access to basic privileges so 
be careful while using Xprivasy You can use applications that give you an unlimited 
trial period by preventing these applications from accessing your phone data such as 
your IP address, MAC address, IMEI number, 
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XPOSED [Method 5: Protect My Privacy (PMP) ] 

Allows the user to protect personal data on Android devices, which provides an 
additional layer of protection between applications and operating system, which gives 
the user the ability to control the authority of applications installed on the device and 
by providing applications with false data or prevent arbitrary access to certain powers 


O Go to the Xposed installer and look for the Protect My Privacy 
(PMP) application and make sure that the latest version 


O Clic 





r ■ — 


Welcome to ProtectMyPrivacy! 



a 


ProtectMyPrivacy (PMP) helps you protect your 
private information by controlling what information is 
provided to an app trying to access it. 

It looks like this is your first time using this version of 
PMP. In the next few pages, we will walk you through 
how to use PMP to manage an app's permissions. 


a 

SKIP 


NEXT 



O Press CONTINUE 
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1 

Terms and Conditions 




any personally identifiable information about you. 
Your IP address will not be captured. 

Procedures 

We are generally asking for how often both 
applications and third-party libraries (which are 
reusable pieces of code inside of applications) attempt 
to access potentially privacy-sensitive material, such 
as a participant’s location, contact list, phone number, 
device ID. and various other privacy sensitive data 
items. We collect anonymized data from users on how 
they allow both applications and third-party libraries 
access to their personal information. 

Benefits 

There is significant personal benefit from using this 
application. The user’s private information on the 
phone has a higher level of protection and the user 
has insights into what applications and third-party 
libraries are trying to access this information. 

Your data and consent form will be kept separate. 

Your consent form will be stored in a secure location 
on Carnegie Mellon property and will not be disclosed 
to third parties. Sharing of data with other researchers 

Q I am 18 years of age or older 
Q I have read and ^Wic above 
I I I am willing loconA^^nonytnoiiUy 




Protected Appsl All applications are protected by PMP implementation 

icatior 


System Appsl System applications 


Third partylThird-party application libraries that violate your privacy 



O Select the application 
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These user-installed apps are protected by PMP. 

AFWall* (Donate) 

•£, «• O i*. Q %' p 



O After choosing the application you can control the permissions either 
Deny Deny or allow Allow or send false data to the application Fake 

>%\ l^\ 

O You can also click Reset App Permission To Ask to display a 
notifications window with the previous options to control the application 
permissions when running it, such as the following application 
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Allow 

Deny 

Ask 

Ask 


O COARSE GRAINED LOCATION 
O VIBRATE 
JL1 CONTACTS READING 
VI CALL LOG READING Ask 

0 CALENDAR READING Ask 

POST NOTIFICATIONS Ask 

P MESSAGES READ LOG Ask 

P TOAST WINDOW Ask 

;= READ EXTERNAL STORAGE Ask 

RESET APP PERMISSIONS TO "ASK" 




O Return to the interface and direct to the settings by pressing Settings 


Firewall Settingsl Firewall settings 

Choose fake locationl To choose a fake geographic location 
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settings 

h 


PMP Settings 
Firewall Settings 
Reset Per < 

Set Default Behavior for Permission Groups 
Choose Fake Location 

Contribute 

Contribute To Our Research 

Additional Info 
View Walkthrough 
Version Info 




O Firewall settings allow you to block IPv6 connection, since most VPN 
services leak IP address to IPv6 except some services such as F-Secure 
Freedome or NordVPN 
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<r FirewallSettings 



Q Enable Firewall 

Block IPv6. Use only if you have connections via IPv4. 




r~= 

] 

<r Settings 



PMP Settings 
Firewall Settings 
Reset Permissions 

jp\ 

Set Default \^»r for Permission Groups 
Choose Fake Location 

Contribute 

Contribute To Our Research 

Additional Info 
View Walkthrough 
Version Info 
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Set All Apps Permissions to Ask 
Set 'My Apps’ Permissions to Ask 
Set ’System Apps' Permissions to Ask 
Set ’Libraries’ Permissions to Ask 



Set Default Permission Groups Behaviorl To set the app permissions i 
general 



PM P Settings 
Firewall Settings 
Reset Permissions 

Set Default Behavior for P^nission Groups 
Choose Fake Location 

Contribute 

Contribute To Our Research 

Additional Info 
View Walkthrough 
Version Info 



Choose fake locationl To choose a fake geographic location 
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<r Settings 


PMP Settings 
Firewall Settings 
Reset Permissions 

Set Default Behavior for Permission Groups 
Choose Fake Location 

Contribute 

Contribute To Our Research 

Additional Info 
View Walkthrough 
Version Info 


ocanon 

d 



♦ Important 

Use the PMP application with Xprivasy to prevent your personal data from 
being leaked to applications and not to be used as an alternative to Xprivasy 
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